6 ms·

UK government's password checker sends plaintext password in the URL over HTTP

226 points by markhemmings 12y ago

markhemmings 12y ago
My initial thoughts are just why not do this client side using javascript? No need for the string to leave the client.
- x1798DE 12y ago
  Not sure how this works, but if I were writing something that checks "goodness" of passwords, I'd want to check it against a large, sorted list of like the 100 million most common passwords (since almost anyone attackers would start with a dictionary attack, and 10-100 million passwords is decently quick to run against a weak key derivation function). Such a database would be huge, so you'd prefer to do that server-side.
  - dasmoth 12y ago
    Bloom filter?
  - gpvos 12y ago
    They don't seem to do a dictionary check at all.
  - neura 12y ago
    Look at the list of things they check. It shows you how they calculate the score for the password. The actual scoring is in fact done in JavaScript, which you can see when you inspect the page. They want the password on the server side purely for statistics or some other reason that has nothing to do with scoring how "secure" the password is.
  - nl 12y ago
    Like dasmoth says, use a Bloom filter. Or run the length and character checks in Javascript, then hash the password and send the hashed version for dictionary lookup.
maaarghk 12y ago
Hahahahaha. This is a total embarrassment and it is why we can't have nice things. There is always this for a decent alternative: https://howsecureismypassword.net/ https://howsecureismypassword.net/
- jacquesm 12y ago
  'abcdefghij' would take 9 hours to crack?
  - unfunco 12y ago
    Thankfully correcthorsebatterystaple takes a quintillion years. I'm safe.
  - maaarghk 12y ago
    I thought they did a bloom search over the top 1000 most common passwords or something, I guess if you feel very strongly about this you could contact the creator :)
- Pxtl 12y ago
  Password1234567890 It would take a desktop PC about A quadrillion years to crack your password [Tweet Result]
  - LeoPanthera 12y ago
    OK, but if you keep reading: "Your password looks like it might just be a word and a few digits. This is a very common pattern and would be cracked very quickly."
- danielweber 12y ago
  abcdefghijklmnopqrstuvwxyz 46 quintillion years score!
PeekPoke 12y ago
Jesus wept....
facorreia 12y ago
This is appalling and inexcusable for a site who claims to help improve security and that claims to have in the team people such as "a foremost expert on information security awareness"[1]. So this cannot be attributed to ignorance. [1] https://www.getsafeonline.org/about-us/ https://www.getsafeonline.org/about-us/
- stuaxo 12y ago
  It was probably outsourced to accenture or similar who then paid the cheapest devs they could find in india.
opendais 12y ago
Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and should fix it? EDIT: Tried to contact them, got a "The form you submitted contained the following errors Missing Data.(DIFFERENT_IP)" error which has nothing to do with the form I submitted. XD Could someone contact them by their contact us page to get this fixed?
- ZoFreX 12y ago
  > Get Safe Online is a jointly funded initiative between several Government departments and private sector businesses. In fact, we are the Government’s preferred online security advice channel. There are adverts everywhere about it with obvious government endorsement. It's not just that they send it over HTTP. It shouldn't send it anywhere, it should all be done client-side with JavaScript. It's more than "you made a little mistake" it's "who are you to tell people what is, or isn't, secure when you can't even manage the basics?"
  - opendais 12y ago
    I'm not from the UK and I never believe anything a company puts on its about us page. ;) If they are doing statistical analysis on password, they'd have to send that information somewhere so I'm not surprised that they are. Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason. Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page.
    - Tyrannosaurs 12y ago
      > Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page. That's genius because scammers would never say something like that because that would be lying and people don't lie because it's naughty.
bitJericho 12y ago
http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=lolwhat%3F http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
- TazeTSchnitzel 12y ago
  http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=http://www.getsafeonline.org/themes/passwrdcheck/results.html?password http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
- dublinben 12y ago
  http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=CorrectHorseBatteryStaple http://www.getsafeonline.org/themes/passwrdcheck/results.htm... I wouldn't trust this site at all with actual passwords.
gtirloni 12y ago
(Never enter your real password into a password checker In their defense, it's stated pretty clearly that you shouldn't enter your real password and that this website allows you to test the "type of passwords" you use. They could use the fact that it's over HTTP to teach a second lesson in the results page about HTTP vs HTTPS, and warn the user again that he/she should stopping using that password immediately.
- yenoham 12y ago
  But their reasoning for not entering your real password into a checker is "...unlike this one, some may be fake" Then they follow it up with "Why not get your family, friends and workmates to test their passwords too?" And the placeholder in the input field is "Enter your password".
- gpvos 12y ago
  Not very clearly. Most people would read over that sentence (I did at first, although I of course wouldn't dream of entering my real password into that site). It should at least be displayed in bold red.
- usefulcat 12y ago
  And immediately after they tell you not to enter your real password, they say "Why not get your family, friends and workmates to test their passwords too?"
- Donzo 12y ago
  If the sentence you quoted were the one that they used, I would agree with you that it was stated clearly. Unfortunately, they chose to word it this way: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" The sentence is parenthetical, undermining it's importance, and it goes in two different directions, which makes it hard to follow. They should clearly advise users against entering their "real" password in one sentence, and then attest to the authenticity of their password checker in a separate sentence. By the end of their sentence, it's hard to tell whether they mean that I shouldn't put my "real" password into other password checkers. The implication is that their password checker is real and safe. A clearer way to phrase it would be like this: "Don't put your real password into this password checker."
iak8god 12y ago
Wow, their advice is terrible too: "86% Exceptional" http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=P@55w0rd http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
- middus 12y ago
  XKCDs correct horse battery staple earns merely 40% ("Warning: Your passwords are weak and your digital life is at risk!") http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=correct%20horse%20battery%20staple http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
  - x1798DE 12y ago
    When in fact it should earn a 0%, because it's in most common password dictionaries now?
    - mikeash 12y ago
      I like the password checkers which just say, "This password is completely insecure, because you just gave it to a strange computer on the internet."
  - giancarlostoro 12y ago
    http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=Correct%20horse%20Battery%20staple http://www.getsafeonline.org/themes/passwrdcheck/results.htm... Capitalize the first letter of correct and battery. Then you get 100% :)
- splike 12y ago
  Change a '5' to a '6' and add a '1' and you get 100% http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=P@56w0rd1 http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
- Pxtl 12y ago
  Password12345 gets 93%.
rikkus 12y ago
This is what I wrote in their 'Contact' form, which returned an error: 'The form you submitted contained the following errors Missing Data.(DIFFERENT_IP) Return to Previous Page' I used your password checker here: http://www.getsafeonline.org/themes/passwrdcheck/index.html http://www.getsafeonline.org/themes/passwrdcheck/index.html I notice that it has set the form field to hide my password as I type it, that there are two lock symbols next to the password box, and that the box is surrounded by a metallic looking image. These factors would probably lead one to believe that you were treating my password with care, ensuring that it would only be relayed to yourselves and no-one else would be able to read it. As an untrusting person, I typed something which is not one of my passwords into the box, just to see what would happen. When I submitted the form, my password was transmitted in clear text over the Internet, where it could be read by anyone who happened to be in a position to sniff traffic. This includes my office network! For a site named 'Get safe online', this seems like the most incredible irony. I will be spreading the word that this site is utterly unsafe to visit, as it is unlikely that I have co-incidentally found the single problem. I notice you advise people that a password 'like' 'SP1D3Rm@n' is secure. This is patently false as such a password is very simple to crack. Again, this one issue I found, after choosing a single page to test, gives me a complete lack in confidence in the advice of the site. I will also be telling people not to heed advice found here. Please get some real expert advice on security as the advice you are giving to others, and the problem[s] with your site are likely to cause real problems for people.
- zhte415 12y ago
  I did a WHOIS, and seeing a domain registration date back to 2005 gave an air of credibility. So then I visited Internet Archive and browsed several pages https://web.archive.org/web/20080701000000*/http://getsafeonline.org https://web.archive.org/web/20080701000000*/http://getsafeon... They seem like experts... experts in subtle verbal manipulation for those without technical understanding, at least that is how it reads for me. Over years of archives, including the OP post, 'protect your family' continually appears as a headline. Monetisation is not explicitly outlined, it appears to be government or PPP funded. Scare tactics, targeted at those probably less internet aware then the HN crowd, rather than education, appear to fund this website by whatever means.
chrismorgan 12y ago
Wow, “vwcsgwuqmhcmzlsfgdmbuvi” is laughable, 24%, while replacing the last two characters with “V:” is exceptional, 100%?
afandian 12y ago
This seems like the right venue to let them know that you have been a victim: https://www.getsafeonline.org/share-your-story/ https://www.getsafeonline.org/share-your-story/
pdpi 12y ago
Considering how they deduct points for "bad practices", and how avoiding those "bad practices" actually makes for a smaller password space, I have half a mind to spend some time figuring out exactly how much smaller the password space is for a given length if you follow all of their advice.
- Anderkent 12y ago
  That's not quite right. Assuming you were picking passwords randomly discarding ones that have repeat letters etc makes for a smaller password space, certainly. However that's not how most passwords are generated, especially among the people that need this advice most. If your password generation algorithm is 'think out a random string' and produces 'aabbbbdccdc' then your password space is tiny. Those practices are meant to address the most common 'patterns' in human-generated passwords, therefore effectively enlarging the password space (any cracker has to enumerate more complicated patterns or brute-force, rather than the simple pattern that our brains would generate by defualt)
  - pdpi 12y ago
    For each rule in isolation, that's true enough. But the point stands: once you add together all those good practices (repetitions, consecutive letters, multiple character sets), how much does that actually reduce the password space? I'm not saying that the space becomes tiny, I'm saying that it becomes smaller, and I'm not sure whether "smaller" is still acceptably large, and it's an assumption that's worth checking.
    - KMag 12y ago
      The cost in entropy for these restrictions isn't zero, but it's tiny and measurable. As a conservative estimate, let's assume passwords are only chosen from a set of 84 printable ASCII characters and users never choose passwords longer than 10 characters. (If users are using characters outside this set or longer passwords, they'll have more choices than we're estimating.) All combinations, including the null password yield 17700847248605297701 combinations, or 63.94 bits of entropy if a password is chosen truly randomly from this set. Restrict them to passwords at least 7 characters long, and that drops to 17700846893074759680, about 1.9e-9 bits less, still above 63.94 bits. Further add the restriction that no two adjacent characters are the same and that drops to 15894480881247564960, or 63.78 bits. Further force the user to use one digit and that drops to 11477476711812418840, or 63.32 bits. For the sake of my time, I'm going to get a bit sloppy and start over-estimating the cost of restrictions. Further force the user to have at least one upper-case and one lower-case letter and that drops to (more than) 10727550596265784840 passwords, or 63.22 bits. So, all of these restrictions together cost less than 0.72 bits of entropy. That an easy price to pay for eliminating large classes of trivial passwords.
Singletoned 12y ago
They are also encouraging people to type their password into random sites, which is IMO the worst aspect of this.
bkurtz13 12y ago
Pass#123 is "exceptional". It worries me that people are slow to accept the realities of the xkcd comic on pass phrases (http://xkcd.com/936/ http://xkcd.com/936/). We are training people to think they are secure with passwords that are ridiculously easy to brute force.
mydigitalself 12y ago
I think the best thing about this is that "Open, sesame" gives a green light, 87% and Exceptional status.
krzrak 12y ago
"Failure Your passwords are laughable which makes you an easy target for cyber criminals. You should disconnect your computer now or got to..." Seriously this is wording on government site? I find it offending.
ianamartin 12y ago
how safe is this password really? and is it better if I add a goat? Gets 100% safe
VBprogrammer 12y ago
The Data Protection Act Under the Data Protection Act, we have a legal duty to protect any information we collect from you. We use encryption software to safeguard your data, and keep strict security standards to prevent any unauthorised access to it. I'm lost for words.
danfolkes 12y ago
Yep, and they add the password to the url: https://www.getsafeonline.org/themes/passwrdcheck/results.html?password=poop https://www.getsafeonline.org/themes/passwrdcheck/results.ht...
mnw21cam 12y ago
<cynical> Nice way for UKGov to harvest a load of passwords for their own use </cynical>
Pxtl 12y ago
What a wonderful tool: http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=Password12345 http://www.getsafeonline.org/themes/passwrdcheck/results.htm... Password12345 is ranked 93% Exceptional!
- psychometry 12y ago
  It's great that the results page has the password right in the URL as a GET variable. Makes it much easier to share it on Facebook.
willvarfar 12y ago
Sort of like http://privatekeycheck.com/ http://privatekeycheck.com/ in the worst possible way?
passfree 12y ago
This is so wrong in some many levels. 1. They should not ask for any password first of all 2. They post the password to their server when they could have checked it on the client 3. The password is sent as GET meaning that it is in the URL and it will be recorded in your history and perhaps anything else that keeps log of the URLs you visit 100% fail
roywiggins 12y ago
password1234 50%: Sufficient a12345678910 92%: Exceptional So, they try to give you negative points for "sequential numbers" but you get more points for having numbers than you lose, so it's useless. As long as you have a 12-character string with at least one number and one letter, your password will probably pass.
hawkharris 12y ago
We should stop using the term "password" and start emphasizing passphrases. A full sentence is much easier to remember, yet harder to crack, than a shorter, cryptic password. Or, as XKCD put it: http://xkcd.com/936/ http://xkcd.com/936/ There's a widespread misconception that words are always bad because of dictionary attacks, but that concern is moot if you use unique words or simply use a long sentence. A major advantage of sentences is that, because they're memorable, you can more easily use a different password for every site.
- RussianCow 12y ago
  I completely agree, but too many websites put upper limits on the password length (which is completely idiotic) to be able to do this in practice.
  - hawkharris 12y ago
    I agree. It is frustrating when websites place arbitrary limits on characters in a passphrase. It's even more frustrating when they add specific rules (e.g. must use at least one number) that actually lower the number of possible combos in the string.
    - tombrossman 12y ago
      The worst annoyance for me is when they accept my 32+ character password - which I generate and paste from a password manager - and then they silently truncate it to a shorter length! No error, nothing. I remember hearing about some services that did this but the longer passwords still worked, which gave users a false sense of security. What I run into more frequently is that I have to click the 'Forgot password' link and reset it. Then I cross my fingers and wait to see if they email it back in plain text (this is unforgivable) so I can count the characters and learn what the max length is that way.
  - l-p 12y ago
    Well, how would they fit the passwords in the database if there was no limit? =)
naturalethic 12y ago
They clearly need more money.
TimWolla 12y ago
Do they really subtract score for consecutive lowercase / uppercase letters or consecutive numbers? Disallowing that reduces the overall entropy.
dc2447 12y ago
http://ismycreditcardstolen.com/ http://ismycreditcardstolen.com/
TimWolla 12y ago
And it's down again. After submitting a password I get redirected to the homepage.
DanBC 12y ago
It is depressing that money is spent on that website rather than on curating a list of good password managers for all platforms and persuading people to move to those. UK government does do some great IT stuff. This isn't one of those. UK gov also has some horrifically over-budget under-performing train wrecks of IT projects so I guess I should be glad that this isn't one of those.
mraison 12y ago
It would be even more fun if they also asked for your email address at the same time (for security, you know, to protect against viruses).
PeekPoke 12y ago
lol - looks like they are in the process of removing the password checker from the site!
jwildeboer 12y ago
Page is gone now. Seems someone noticed and did the only right thing.
KaiserPro 12y ago
wait, they actually encourage entering you password into random websites? how in living fuck is that a clever idea?
Pxtl 12y ago
It's gone. Somebody noticed.
a3_nm 12y ago
Related: http://www.inutile.ens.fr/estatis/password-security-checker/ http://www.inutile.ens.fr/estatis/password-security-checker/
deleted 12y ago
[deleted]
LeoPanthera 12y ago
It seems they heard us, the page is now 404.
KMag 12y ago
password123; DROP TABLE PASSWORDS -- My password score is 502 Error: Bad Gateway. What did everyone else score? In all seriousness, among the http, the GET param, and the laughable entropy estimates, I wouldn't be surprised if they threw in an SQL injection vuln, a buffer overflow, and a couple of XSS vulns as Easter eggs.

226 points by markhemmings 12y ago

markhemmings 12y ago

My initial thoughts are just why not do this client side using javascript? No need for the string to leave the client.

x1798DE 12y ago
Not sure how this works, but if I were writing something that checks "goodness" of passwords, I'd want to check it against a large, sorted list of like the 100 million most common passwords (since almost anyone attackers would start with a dictionary attack, and 10-100 million passwords is decently quick to run against a weak key derivation function). Such a database would be huge, so you'd prefer to do that server-side.
- dasmoth 12y ago
  Bloom filter?
- gpvos 12y ago
  They don't seem to do a dictionary check at all.
- neura 12y ago
  Look at the list of things they check. It shows you how they calculate the score for the password. The actual scoring is in fact done in JavaScript, which you can see when you inspect the page. They want the password on the server side purely for statistics or some other reason that has nothing to do with scoring how "secure" the password is.
- nl 12y ago
  Like dasmoth says, use a Bloom filter. Or run the length and character checks in Javascript, then hash the password and send the hashed version for dictionary lookup.

maaarghk 12y ago

Hahahahaha. This is a total embarrassment and it is why we can't have nice things. There is always this for a decent alternative: https://howsecureismypassword.net/ https://howsecureismypassword.net/

jacquesm 12y ago
'abcdefghij' would take 9 hours to crack?
- unfunco 12y ago
  Thankfully correcthorsebatterystaple takes a quintillion years. I'm safe.
- maaarghk 12y ago
  I thought they did a bloom search over the top 1000 most common passwords or something, I guess if you feel very strongly about this you could contact the creator :)
Pxtl 12y ago
Password1234567890 It would take a desktop PC about A quadrillion years to crack your password [Tweet Result]
- LeoPanthera 12y ago
  OK, but if you keep reading: "Your password looks like it might just be a word and a few digits. This is a very common pattern and would be cracked very quickly."
danielweber 12y ago
abcdefghijklmnopqrstuvwxyz 46 quintillion years score!

PeekPoke 12y ago

Jesus wept....

facorreia 12y ago

This is appalling and inexcusable for a site who claims to help improve security and that claims to have in the team people such as "a foremost expert on information security awareness"[1]. So this cannot be attributed to ignorance. [1] https://www.getsafeonline.org/about-us/ https://www.getsafeonline.org/about-us/

stuaxo 12y ago
It was probably outsourced to accenture or similar who then paid the cheapest devs they could find in india.

opendais 12y ago

Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and should fix it? EDIT: Tried to contact them, got a "The form you submitted contained the following errors Missing Data.(DIFFERENT_IP)" error which has nothing to do with the form I submitted. XD Could someone contact them by their contact us page to get this fixed?

ZoFreX 12y ago
> Get Safe Online is a jointly funded initiative between several Government departments and private sector businesses. In fact, we are the Government’s preferred online security advice channel. There are adverts everywhere about it with obvious government endorsement. It's not just that they send it over HTTP. It shouldn't send it anywhere, it should all be done client-side with JavaScript. It's more than "you made a little mistake" it's "who are you to tell people what is, or isn't, secure when you can't even manage the basics?"
- opendais 12y ago
  I'm not from the UK and I never believe anything a company puts on its about us page. ;) If they are doing statistical analysis on password, they'd have to send that information somewhere so I'm not surprised that they are. Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason. Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page.
  - Tyrannosaurs 12y ago
    > Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page. That's genius because scammers would never say something like that because that would be lying and people don't lie because it's naughty.

bitJericho 12y ago

http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=lolwhat%3F http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

TazeTSchnitzel 12y ago
http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=http://www.getsafeonline.org/themes/passwrdcheck/results.html?password http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
dublinben 12y ago
http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=CorrectHorseBatteryStaple http://www.getsafeonline.org/themes/passwrdcheck/results.htm... I wouldn't trust this site at all with actual passwords.

gtirloni 12y ago

(Never enter your real password into a password checker In their defense, it's stated pretty clearly that you shouldn't enter your real password and that this website allows you to test the "type of passwords" you use. They could use the fact that it's over HTTP to teach a second lesson in the results page about HTTP vs HTTPS, and warn the user again that he/she should stopping using that password immediately.

yenoham 12y ago
But their reasoning for not entering your real password into a checker is "...unlike this one, some may be fake" Then they follow it up with "Why not get your family, friends and workmates to test their passwords too?" And the placeholder in the input field is "Enter your password".
gpvos 12y ago
Not very clearly. Most people would read over that sentence (I did at first, although I of course wouldn't dream of entering my real password into that site). It should at least be displayed in bold red.
usefulcat 12y ago
And immediately after they tell you not to enter your real password, they say "Why not get your family, friends and workmates to test their passwords too?"
Donzo 12y ago
If the sentence you quoted were the one that they used, I would agree with you that it was stated clearly. Unfortunately, they chose to word it this way: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" The sentence is parenthetical, undermining it's importance, and it goes in two different directions, which makes it hard to follow. They should clearly advise users against entering their "real" password in one sentence, and then attest to the authenticity of their password checker in a separate sentence. By the end of their sentence, it's hard to tell whether they mean that I shouldn't put my "real" password into other password checkers. The implication is that their password checker is real and safe. A clearer way to phrase it would be like this: "Don't put your real password into this password checker."

iak8god 12y ago

Wow, their advice is terrible too: "86% Exceptional" http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=P@55w0rd http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

middus 12y ago
XKCDs correct horse battery staple earns merely 40% ("Warning: Your passwords are weak and your digital life is at risk!") http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=correct%20horse%20battery%20staple http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
- x1798DE 12y ago
  When in fact it should earn a 0%, because it's in most common password dictionaries now?
  - mikeash 12y ago
    I like the password checkers which just say, "This password is completely insecure, because you just gave it to a strange computer on the internet."
- giancarlostoro 12y ago
  http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=Correct%20horse%20Battery%20staple http://www.getsafeonline.org/themes/passwrdcheck/results.htm... Capitalize the first letter of correct and battery. Then you get 100% :)
splike 12y ago
Change a '5' to a '6' and add a '1' and you get 100% http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=P@56w0rd1 http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
Pxtl 12y ago
Password12345 gets 93%.

rikkus 12y ago

This is what I wrote in their 'Contact' form, which returned an error: 'The form you submitted contained the following errors Missing Data.(DIFFERENT_IP) Return to Previous Page' I used your password checker here: http://www.getsafeonline.org/themes/passwrdcheck/index.html http://www.getsafeonline.org/themes/passwrdcheck/index.html I notice that it has set the form field to hide my password as I type it, that there are two lock symbols next to the password box, and that the box is surrounded by a metallic looking image. These factors would probably lead one to believe that you were treating my password with care, ensuring that it would only be relayed to yourselves and no-one else would be able to read it. As an untrusting person, I typed something which is not one of my passwords into the box, just to see what would happen. When I submitted the form, my password was transmitted in clear text over the Internet, where it could be read by anyone who happened to be in a position to sniff traffic. This includes my office network! For a site named 'Get safe online', this seems like the most incredible irony. I will be spreading the word that this site is utterly unsafe to visit, as it is unlikely that I have co-incidentally found the single problem. I notice you advise people that a password 'like' 'SP1D3Rm@n' is secure. This is patently false as such a password is very simple to crack. Again, this one issue I found, after choosing a single page to test, gives me a complete lack in confidence in the advice of the site. I will also be telling people not to heed advice found here. Please get some real expert advice on security as the advice you are giving to others, and the problem[s] with your site are likely to cause real problems for people.

zhte415 12y ago
I did a WHOIS, and seeing a domain registration date back to 2005 gave an air of credibility. So then I visited Internet Archive and browsed several pages https://web.archive.org/web/20080701000000*/http://getsafeonline.org https://web.archive.org/web/20080701000000*/http://getsafeon... They seem like experts... experts in subtle verbal manipulation for those without technical understanding, at least that is how it reads for me. Over years of archives, including the OP post, 'protect your family' continually appears as a headline. Monetisation is not explicitly outlined, it appears to be government or PPP funded. Scare tactics, targeted at those probably less internet aware then the HN crowd, rather than education, appear to fund this website by whatever means.

chrismorgan 12y ago

Wow, “vwcsgwuqmhcmzlsfgdmbuvi” is laughable, 24%, while replacing the last two characters with “V:” is exceptional, 100%?

afandian 12y ago

This seems like the right venue to let them know that you have been a victim: https://www.getsafeonline.org/share-your-story/ https://www.getsafeonline.org/share-your-story/

pdpi 12y ago

Considering how they deduct points for "bad practices", and how avoiding those "bad practices" actually makes for a smaller password space, I have half a mind to spend some time figuring out exactly how much smaller the password space is for a given length if you follow all of their advice.

Anderkent 12y ago
That's not quite right. Assuming you were picking passwords randomly discarding ones that have repeat letters etc makes for a smaller password space, certainly. However that's not how most passwords are generated, especially among the people that need this advice most. If your password generation algorithm is 'think out a random string' and produces 'aabbbbdccdc' then your password space is tiny. Those practices are meant to address the most common 'patterns' in human-generated passwords, therefore effectively enlarging the password space (any cracker has to enumerate more complicated patterns or brute-force, rather than the simple pattern that our brains would generate by defualt)
- pdpi 12y ago
  For each rule in isolation, that's true enough. But the point stands: once you add together all those good practices (repetitions, consecutive letters, multiple character sets), how much does that actually reduce the password space? I'm not saying that the space becomes tiny, I'm saying that it becomes smaller, and I'm not sure whether "smaller" is still acceptably large, and it's an assumption that's worth checking.
  - KMag 12y ago
    The cost in entropy for these restrictions isn't zero, but it's tiny and measurable. As a conservative estimate, let's assume passwords are only chosen from a set of 84 printable ASCII characters and users never choose passwords longer than 10 characters. (If users are using characters outside this set or longer passwords, they'll have more choices than we're estimating.) All combinations, including the null password yield 17700847248605297701 combinations, or 63.94 bits of entropy if a password is chosen truly randomly from this set. Restrict them to passwords at least 7 characters long, and that drops to 17700846893074759680, about 1.9e-9 bits less, still above 63.94 bits. Further add the restriction that no two adjacent characters are the same and that drops to 15894480881247564960, or 63.78 bits. Further force the user to use one digit and that drops to 11477476711812418840, or 63.32 bits. For the sake of my time, I'm going to get a bit sloppy and start over-estimating the cost of restrictions. Further force the user to have at least one upper-case and one lower-case letter and that drops to (more than) 10727550596265784840 passwords, or 63.22 bits. So, all of these restrictions together cost less than 0.72 bits of entropy. That an easy price to pay for eliminating large classes of trivial passwords.

Singletoned 12y ago

They are also encouraging people to type their password into random sites, which is IMO the worst aspect of this.

bkurtz13 12y ago

Pass#123 is "exceptional". It worries me that people are slow to accept the realities of the xkcd comic on pass phrases (http://xkcd.com/936/ http://xkcd.com/936/). We are training people to think they are secure with passwords that are ridiculously easy to brute force.

mydigitalself 12y ago

I think the best thing about this is that "Open, sesame" gives a green light, 87% and Exceptional status.

krzrak 12y ago

"Failure Your passwords are laughable which makes you an easy target for cyber criminals. You should disconnect your computer now or got to..." Seriously this is wording on government site? I find it offending.

ianamartin 12y ago

how safe is this password really? and is it better if I add a goat? Gets 100% safe

VBprogrammer 12y ago

The Data Protection Act Under the Data Protection Act, we have a legal duty to protect any information we collect from you. We use encryption software to safeguard your data, and keep strict security standards to prevent any unauthorised access to it. I'm lost for words.

danfolkes 12y ago

Yep, and they add the password to the url: https://www.getsafeonline.org/themes/passwrdcheck/results.html?password=poop https://www.getsafeonline.org/themes/passwrdcheck/results.ht...

mnw21cam 12y ago

<cynical> Nice way for UKGov to harvest a load of passwords for their own use </cynical>

Pxtl 12y ago

What a wonderful tool: http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=Password12345 http://www.getsafeonline.org/themes/passwrdcheck/results.htm... Password12345 is ranked 93% Exceptional!

psychometry 12y ago
It's great that the results page has the password right in the URL as a GET variable. Makes it much easier to share it on Facebook.

willvarfar 12y ago

Sort of like http://privatekeycheck.com/ http://privatekeycheck.com/ in the worst possible way?

passfree 12y ago

This is so wrong in some many levels. 1. They should not ask for any password first of all 2. They post the password to their server when they could have checked it on the client 3. The password is sent as GET meaning that it is in the URL and it will be recorded in your history and perhaps anything else that keeps log of the URLs you visit 100% fail

roywiggins 12y ago

password1234 50%: Sufficient a12345678910 92%: Exceptional So, they try to give you negative points for "sequential numbers" but you get more points for having numbers than you lose, so it's useless. As long as you have a 12-character string with at least one number and one letter, your password will probably pass.

hawkharris 12y ago

We should stop using the term "password" and start emphasizing passphrases. A full sentence is much easier to remember, yet harder to crack, than a shorter, cryptic password. Or, as XKCD put it: http://xkcd.com/936/ http://xkcd.com/936/ There's a widespread misconception that words are always bad because of dictionary attacks, but that concern is moot if you use unique words or simply use a long sentence. A major advantage of sentences is that, because they're memorable, you can more easily use a different password for every site.

RussianCow 12y ago
I completely agree, but too many websites put upper limits on the password length (which is completely idiotic) to be able to do this in practice.
- hawkharris 12y ago
  I agree. It is frustrating when websites place arbitrary limits on characters in a passphrase. It's even more frustrating when they add specific rules (e.g. must use at least one number) that actually lower the number of possible combos in the string.
  - tombrossman 12y ago
    The worst annoyance for me is when they accept my 32+ character password - which I generate and paste from a password manager - and then they silently truncate it to a shorter length! No error, nothing. I remember hearing about some services that did this but the longer passwords still worked, which gave users a false sense of security. What I run into more frequently is that I have to click the 'Forgot password' link and reset it. Then I cross my fingers and wait to see if they email it back in plain text (this is unforgivable) so I can count the characters and learn what the max length is that way.
- l-p 12y ago
  Well, how would they fit the passwords in the database if there was no limit? =)

naturalethic 12y ago

They clearly need more money.

TimWolla 12y ago

Do they really subtract score for consecutive lowercase / uppercase letters or consecutive numbers? Disallowing that reduces the overall entropy.

dc2447 12y ago

http://ismycreditcardstolen.com/ http://ismycreditcardstolen.com/

TimWolla 12y ago

And it's down again. After submitting a password I get redirected to the homepage.

DanBC 12y ago

It is depressing that money is spent on that website rather than on curating a list of good password managers for all platforms and persuading people to move to those. UK government does do some great IT stuff. This isn't one of those. UK gov also has some horrifically over-budget under-performing train wrecks of IT projects so I guess I should be glad that this isn't one of those.

mraison 12y ago

It would be even more fun if they also asked for your email address at the same time (for security, you know, to protect against viruses).

PeekPoke 12y ago

lol - looks like they are in the process of removing the password checker from the site!

jwildeboer 12y ago

Page is gone now. Seems someone noticed and did the only right thing.

KaiserPro 12y ago

wait, they actually encourage entering you password into random websites? how in living fuck is that a clever idea?

Pxtl 12y ago

It's gone. Somebody noticed.

a3_nm 12y ago

Related: http://www.inutile.ens.fr/estatis/password-security-checker/ http://www.inutile.ens.fr/estatis/password-security-checker/

deleted 12y ago

[deleted]

LeoPanthera 12y ago

It seems they heard us, the page is now 404.

KMag 12y ago

password123; DROP TABLE PASSWORDS -- My password score is 502 Error: Bad Gateway. What did everyone else score? In all seriousness, among the http, the GET param, and the laughable entropy estimates, I wouldn't be surprised if they threw in an SQL injection vuln, a buffer overflow, and a couple of XSS vulns as Easter eggs.